CVE-2026-75904
libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat_loops, so an index of zero reads pat_loops[-1], one byte before the array. The index is the smpno field of a parsed MIDI event, which is initialised to zero and only later overwritten from a program-change parameter, so an event reaching the note test before an instrument is assigned carries zero. A 32-byte MIDI file supplied to the library's public ModPlug_Load entry point drives the path through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read out of bounds determines whether a note event is treated as looping, so adjacent static storage influences playback state.
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| audio/libmodplug | libmodplug | 0.8.9.1.r461 | unaddressed | ehaupt@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>libmodplug</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libmodplug through 0.8.9.1 contains an out-of-bounds read in
pat_smplooped in src/load_pat.cpp. The function validates only the
upper bound of its sample index against MAXSMP and then subtracts one
before indexing the 191-byte static array pat_loops, so an index of
zero reads pat_loops[-1], one byte before the array. The index is the
smpno field of a parsed MIDI event, which is initialised to zero and
only later overwritten from a program-change parameter, so an event
reaching the note test before an instrument is assigned carries zero.
A 32-byte MIDI file supplied to the library's public ModPlug_Load
entry point drives the path through CSoundFile::Create,
CSoundFile::ReadMID, and MID_ReadPatterns to the read. The byte read
out of bounds determines whether a note event is treated as looping,
so adjacent static storage influences playback state.</p>
</body>
</description>
<references>
<cvename>CVE-2026-75904</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-75904</url>
</references>
<dates>
<discovery>2026-08-18</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>